ICS Threat Assessment & Risk Analysis 2 — Questions and Answers
Question 1: In ICS environments, which threat modeling methodology is most commonly adapted to account for physical-cyber interdependencies?
- PASTA
- STRIDE (Correct answer)
- OCTAVE
- TRIKE
Correct answer: STRIDE
STRIDE is widely adapted for ICS threat modeling because its spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege categories map naturally to both cyber and physical control system attack vectors.
Question 2: A risk analyst discovers that a legacy PLC has no authentication and communicates over Modbus TCP. Which risk factor most directly increases the likelihood score in a quantitative risk assessment?
- High asset criticality
- Lack of network segmentation
- Absence of access controls on the device
- Known vulnerability with public exploit code (Correct answer)
Correct answer: Known vulnerability with public exploit code
A known vulnerability with publicly available exploit code dramatically increases likelihood because threat actors can weaponize it without advanced capabilities, directly elevating the probability component of the risk formula.
Question 3: Which document provides the foundational risk management framework specifically referenced in NIST SP 800-82 for ICS security?
- NIST SP 800-37
- NIST SP 800-53
- NIST SP 800-30 (Correct answer)
- NIST CSF
Correct answer: NIST SP 800-30
NIST SP 800-30 provides the Guide for Conducting Risk Assessments and is the foundational document cited in NIST SP 800-82 for performing risk assessments in ICS environments.
Question 4: During a threat assessment of a water treatment SCADA system, an analyst identifies an insider with legitimate access who has expressed grievances. This threat actor is best classified as:
- Advanced Persistent Threat
- Hacktivist
- Malicious insider (Correct answer)
- Script kiddie
Correct answer: Malicious insider
An employee with authorized access who may use that access maliciously due to personal motivations is classified as a malicious insider, a particularly dangerous threat in ICS environments due to existing access and system knowledge.
Question 5: What is the primary purpose of a Bow-Tie analysis in ICS risk assessment?
- To calculate return on security investment
- To visualize threat pathways, preventive barriers, and consequence mitigations simultaneously (Correct answer)
- To rank vulnerabilities by CVSS score
- To map network topology for penetration testing
Correct answer: To visualize threat pathways, preventive barriers, and consequence mitigations simultaneously
Bow-Tie analysis visually connects threats on the left (causes) through a central hazard event to consequences on the right, showing both preventive controls and recovery mitigations in a single diagram.
Question 6: An ICS risk assessment uses the formula Risk = Consequence × Likelihood. If a threat scenario has a consequence score of 4 and a likelihood score of 2, but adding a firewall reduces likelihood to 1, what is the residual risk value?
- 2
- 4 (Correct answer)
- 6
- 8
Correct answer: 4
Residual risk = Consequence × Reduced Likelihood = 4 × 1 = 4, demonstrating how a control reduces likelihood while consequence remains unchanged.
Question 7: Which ICS-specific threat intelligence source focuses exclusively on industrial control system vulnerabilities and advisories issued by the U.S. government?
- MITRE ATT&CK Enterprise
- CISA ICS-CERT Advisories (Correct answer)
- OWASP Top 10
- CVE National Database
Correct answer: CISA ICS-CERT Advisories
CISA ICS-CERT Advisories are specifically produced by the Cybersecurity and Infrastructure Security Agency to address vulnerabilities and threats targeting industrial control systems.
ICS Threat Assessment & Risk Analysis 2
In ICS environments, which threat modeling methodology is most commonly adapted to account for physical-cyber interdependencies?